Data protection

Cargolux International Airlines S.A. Luxembourg Airport, Luxembourg (hereafter referred to as “Cargolux” or “we”) is committed to protecting the privacy of its website visitors. Depending on your usage of our website (the “Website”), some information about you (hereinafter referred to as “personal data”) will be collected.

This Data Protection Notice is directed to users or visitors of our Website, as well as to any individuals or organizations’ representatives who interact with us through the Website (e.g., by browsing the Website, or submitting information or applications online) (together “you”). It explains how we use your personal data, complying with the rules currently stated in the General Data Protection Regulation EU 2016/679 (“GDPR”) on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

This Data Protection Notice may be modified to reflect changes on the Website or on our processing activities, to comply with legal amendments, or to integrate best practices. Updates of the Data Protection Notice will be published on our Website once available.

Who is the controller of your personal data?

Cargolux is responsible for collecting and processing your personal data in relation to your use of the Website.

What personal data does Cargolux collect?

We may process various types of personal data about you, including electronic identification data (eg. information concerning the name of the domain and host from which you access the internet; the browser software and operating system of your computer; the internet protocol (“IP”) address of your computer; the internet address of the site from which you linked directly to the Website; and the time and date you accessed the Website).

Other categories of personal data may be processed when you volunteer to identify yourself and provide requested information in order for Cargolux to reply, follow-up and manage your requests.

What are the purposes and the legal basis for Cargolux's prosessing avticities?

Cargolux uses your personal data for the following purposes:

as regards information provided by you through our online forms: to answer your questions; handle your requests and applications; provide the services you have requested; send you our newsletter and marketing materials if you have chosen to subscribe; manage our business relationship with you; and manage and/or improve our services and the Website,

as regards technical data collected by us when you use this Website: to generate or improve our services and the Website.

Cargolux’s processing activities are based on the following legal basis:

to perform a contract or for pre-contractual measures with you or an organization you represent,

to comply with our legal and regulatory obligations,
pursuing our legitimate interests (e.g., to manage and improve our services or the Website, to send newsletters to which you have subscribed),

in exceptional situations, your consent.

Who do we share your personal data with?

We may disclose your personal data:

to members of the Cargolux group for the purposes described in the terms of use.

to third parties providing services to us, namely, website hosting, IT services and other similar services to enable them to provide their services.

on comment boards of the newsletter to which you can post information and that will be seen by other users of the website. Please note that information posted on these boards will be available to the public.

to third parties outside the Cargolux group, if obliged by competent authorities as per the applicable laws. The user will be informed accordingly, to the extent permitted by the applicable law.

How do we protect your personal data?

We have implemented technical and organizational security measures to protect your personal data from unauthorized access, improper use, alteration, unlawful or accidental destruction and loss.

Nevertheless, no data transmission or storage over the internet can be guaranteed to be 100% secured. If you feel that the security of any account you might have with us has been compromised, please immediately notify us of the problem by contacting us in accordance with the "Contacting Us" section below.

Where do we transfer your data to?

Your personal data are processed by us within the European Union and no transfer of your personal data occurs outside of the European Union/European Economic Area (EU/EEA).

For how long do we keep your data?

Unless a longer retention period is required or permitted by law, your personal data will be stored during the necessary period, according to the specific purpose:

as regards information you provided on our online forms: for the time necessary to respond to your question or handle your request. The retention of such information will normally not exceed two years from registration, unless you have requested us to delete such information or application,

as regards technical data collected during your use of the Website: for a maximum period of six months from the date of collection.

After these retention periods the data will be completely deleted from Cargolux’s system, saved in case of dispute or legal claim (insofar as necessary to exercise or defend our rights) or if any legal obligations of retaining such data apply.

With regard to the Newsletter, you will be able to unsubscribe at any moment and your personal data will be deleted upon your request.

What are your rights?

In accordance with the applicable data protection law (and subject to conditions and restrictions set forth therein), you may exercise at any time the following rights in relation to your personal data:

right of access: which enables you to obtain from us confirmation of whether your personal data is being processed or not and, if so, obtain access to such data; considering that we process a large quantity of information; when exercising your right of access you should specify the transaction, information or processing activities to which your request relates;

right to rectification: which enables you to obtain from us the correction and/or integration of any of your personal data that are incorrect and/or incomplete;

right to erasure: which enables you, in specific cases provided for by art. 17 GDPR, to obtain from us the erasure of your personal data;
right to restriction of processing, which enables you, in the specific cases provided for by art. 18 of the GDPR, to restrict the processing of your personal data by us;

right to object: which enables you to object to the processing of your personal data when certain conditions are met;

right to data portability: which enables you, in certain cases (subject to particular to technical feasibility) and only with regard to the data you have provided, to request receipt of your personal data in a structured and commonly machine-readable format.

right to lodge a complaint: under which you are entitled to lodge a formal complaint with the Commission nationale pour la protection des données (CNPD).

If you have provided your consent to the processing of your personal data, you can withdraw such consent at any time.

If you no longer want to receive our newsletter and related marketing materials, please use the Unsubscribe option in the mailings.

To exercise any of these rights, you may contact us by email dataprotection@cargolux.com or by postal mail:

Cargolux Airlines International S.A.
Compliance Department
Luxembourg Airport
L-2990 Luxembourg
Luxembourg

Cargolux International Airlines S.A., Luxembourg Airport, Luxembourg (hereafter referred to as “Cargolux” or “we”) is committed to the protection of your personal data in accordance with data protection legislation, especially the General Data Protection Regulation EU 2016/679 (the “GDPR”).

This Data Protection Notice is intended to inform Cargolux employees, visitors of its buildings, infrastructure and site (“you”) on the use of a video-surveillance system (the “video-surveillance system”), how long we keep data, what rights you have and how you can exercise them.

1. Who is the controller of your personal data?

Cargolux is responsible, as a data controller, for collecting and processing your personal data under the video-surveillance system, determining the purposes and means of such processing.

2. What personal data do we process?

We collect and use your image when you enter or circulate in buildings or locations covered by our video-surveillance system (the “premises”). Pictograms are displayed at the entrance of, and around the premises. The data we collect include the following categories of data:

images caught on cameras installed in monitored premises indicated by pictograms (no sound is recorded),

dates and hours of recordings.

3. Why do we process your personal data (purpose and legal basis)?

We collect and use your personal data for the following purposes:

to control access to and to ensure the security of the premises, the safety of Cargolux staff and visitors, as well as property, assets and information located or stored in the premises;

to prevent, deter, and if necessary, investigate unauthorized access, including unauthorised access to secure premises and protected rooms, IT infrastructure, or operational information;

to prevent, detect and investigate unauthorised or unacceptable behaviours, including potential criminal offences, such as theft of equipment or assets owned by Cargolux, its customers, visitors or staff or threats to the safety of persons present in the premises (in case of, e.g. fire, accident or physical assault).

The video-surveillance system is not used for purposes that are incompatible with those detailed above.

Where allowed by law, the video-surveillance system may be used as an investigative tool or to obtain evidence in internal investigations or disciplinary procedures, including in case of a security incident.

We collect your personal data to pursue Cargolux’s legitimate interests (art. 6, 1 (f) GDPR), including access control, security of premises, safety of staff and visitors, protection of our interest and rights in the event of investigated, suspected or actual violations or criminal offences.

Where applied to Cargolux’s staff, video-surveillance systems comply with article L. 261-1 of the Luxembourg Labour Code.

4. Who can access your personal data?

In order to fulfil the aforementioned purposes, your personal data can only be accessed by a limited number of staff from the Corporate Security Department.

We may communicate your personal data to:

service providers/vendors (such as a contracted security company) that perform services on our behalf,

the Police, law enforcement or other government and regulatory bodies or agencies, upon request and to the extent permitted by law.

5. Where to we transfer your personal data?

Your personal data are processed by us within the European Union and no transfer of your personal data occurs outside of the European Union/European Economic Area (EU/EEA).

6. Security of your personal data

The processing of your personal data is carried out through IT, electronic and manual tools, with logics strictly related to the aforementioned purposes and, in any event, in compliance with the appropriate technical and organisational measures required by law to ensure a level of security that is adequate to the risk, in order to avoid unauthorised loss of or access to your data.

7. How long do we keep your personal data?

We will retain your personal data for 21 days from their recording, except in the event of an incident, investigation or legal proceedings. At the end of that period your personal data will be deleted or destroyed.

8.What are your rights regarding your personal data?

In accordance with applicable data protection law (and subject to conditions and restrictions set forth therein), you may exercise at any time your right to access, which enables you to obtain from us confirmation on whether your personal data are being processed or not and, if so, obtain access to such data; we process a large quantity of information, and can thus request, in accordance with GDPR, that before the information is provided, you specify the transaction, information or processing activities to which your request relates.

In certain limited cases (in which case we will analyse whether the conditions for the exercise of such rights are fulfilled, in line with the GDPR), you may exercise the following rights in relation to your personal data:

right to erasure: which enables you, in specific cases provided for by art. 17 GDPR, to obtain from us the erasure of your personal data;
right to restriction of processing: which enables you, in the specific cases provided for by art. 18 of the GDPR, to restrict the processing of your personal data by us;
right to object: which enables you to object to the processing of your personal data when certain conditions are met.
To exercise any of these rights, you may contact us by email dataprotection@cargolux.com or by postal mail:

Cargolux Airlines International S.A.
Compliance Department
Luxembourg Airport
L-2990 Luxembourg
Luxembourg

You have the right to lodge a formal complaint with the Commission nationale pour la protection des données.

9. Changes to this data protection notice for video-surveillance

Changes may occur in the way we process personal data. In case these changes oblige us to update this Data Protection Notice for Video-surveillance, we will clearly communicate it to you, either via our website or via other appropriate means. The latest applicable version will always be available on our website.

General statement

Cargolux Airlines International S.A. (or the “Company”) is committed to the protection of your personal data in accordance with data protection legislation, especially the EU General Data Protection Regulation 2016/679 (known as “GDPR”). Cargolux abides, at all times, by the rules set out in the GDPR and all other applicable data protection laws.
The following paragraphs contains information about (i) the types of personal data we process about you, (ii) the purpose of their collection, (iii) who we share your data with, (iv) for how long your data is retained, and (iv) your rights and our obligations under the GDPR.

What personal data do we process and why do we process it?

Cargolux, acting as data controller will process your personal for limited and specific purposes. These include to

Communicate with you in relation to Cargolux services via email, namely, to send you our Monthly Newsletter and provide you with relevant information and updates such as embargoes, customs requirements, fuel surcharges, etc.

Pursue our legitimate interests, such as email marketing, market research, customer relationship management and to assess and improve our communication channels and practices.

For these purposes, we will process personal data, such as: first and last name, professional email address, and professional phone number. To ensure that the marketing and sales communications sent are tailored and aligned with your business needs, Cargolux will also process: job titles; country / city ZIP codes and information regarding services previously acquired.

The legal basis for the processing of your personal data are Cargolux’s legitimate interests to: carry out marketing activities; market research; improve its communication and marketing channels (article 6,1 f) of the GDPR). In some cases, where Cargolux is communicating with you in the context of the provision of services, the processing of your personal data is based on the performance of the General Terms and Conditions of Cargo Sales (article 6, 1 b) of the GDPR) executed between Cargolux and the customer.

Cargolux will also use data to perform statistical research regarding the way in which its communication/sales channels, websites, products and services are being used by customers with a view of improving them. Note, however, that when pursuing these purposes Cargolux will exclusively rely on anonymized data.

How and with whom do we share your information?

Cargolux may be required to communicate your personal data to third parties such as: (a) Service providers that perform services on our behalf, where applicable and to the extent such data is necessary and relevant for the provision of said services; (b) Law enforcement or other government and regulatory bodies or agencies, upon request and to the extent permitted by law; and (c) Certain regulated professionals such as lawyers or auditors.
In case of international transfers originating from the EU/EEA to a country outside the EU/EEA, the transfer of your personal data may occur where the European Commission has determined that the country outside the EU/EEA ensures an adequate level of data protection. For transfers to countries outside the EU/EEA for which the level of protection has not been recognised as adequate by the European Commission, Cargolux will implement appropriate safeguards provided for by current data protection laws (e.g. the entry into standard data protection clauses) or rely on a derogation applicable to specific situations.

How do we secure your personal data?

The processing of your personal data is carried out through IT, electronic and manual tools, with logics strictly related to the aforementioned purposes. Cargolux has implemented the appropriate technical and organisational measures required by law to ensure a level of security adequate to the risk, in order to avoid accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to your data (eg. Multi-factor Authentication, Access Control Lists).
To ensure the safety and security of your personal data, Cargolux gives access to personal data inside the Company on a need-to-know basis. This means that personal data should only be accessed to those who need such personal data in the scope of their role and within the limits imposed by the laws.
To reduce the risks resulting from your personal data being compromised or misused, the retention periods have been limited to a time which is necessary to fulfil the purpose for which the personal data has been collected.

What are your rights?

Under the GDPR, you have the following rights:

Right to Access: You have the right to question us about any data we have regarding you, and to request access to it. Examples of information that you have access to include the purpose of the processing, the categories of the data collected, and the safeguards in place for the transfer of your data to third countries.

Right to Data Portability: Where applicable, you have the right to ask that we transmit some of your data to another organization.

Right to Correction: If you believe that any of your personal data is incorrect or inaccurate, you have a right to ask that we correct it.

Right to Erasure: You have a right to request us to erase personal data concerning you. Please keep in mind that this is not an absolute right, as we may be required by law to process certain personal data from you. For instance, you can exercise this right when:

You believe that we no longer need the data for the purpose for which they were collected,

You have reason to believe that we have processed the data unlawfully,

You believe we have a legal obligation to delete your personal data.

Right to Withdraw Consent: If we process your personal data on the basis of your consent, you have the right to withdraw consent at any time. You do not need to provide a reason to withdraw consent.

Restriction of Processing: You may have a right to ask us to restrict the processing of your data. For instance, you may do so when:

You believe the personal data we have of you is inaccurate,

You believe the personal data processing is unlawful,
We no longer need the data, but you require the data for the exercise of legal claims,

You have objected to the processing of your data and are awaiting the outcome of this objection.

Objecting to Processing: You have a right to object to the processing of certain types of your personal data collected by us. However, we might continue the processing where we can demonstrate an overriding interest, or where we need the data for the establishment, exercise, or defence of legal claims.

Right to lodge a complaint: You have the right to file a complaint with a Data Protection Supervisory Authority if you consider that the processing of your personal data infringes data protection regulations. In Luxembourg, the Supervisory Authority is the Commission nationale pour la protection des données “CNPD” (https://cnpd.public.lu/)

Please be informed that since your personal information is processed in the context of an existing commercial relationship between Cargolux and a customer, we rely on your soft opt-in for email marketing purposes. This means that although we do not ask for your consent, you have the right to unsubscribe from marketing communications sent by Cargolux, at any time. Note, however, that you may still receive sales and marketing communications that are deemed necessary in the scope of the provision of services by Cargolux to the customer.
If you have any questions regarding the processing of your personal data by Cargolux, or if you wish to exercise your rights as a data subject, you can contact the Data Protection Unit at dataprotection@cargolux.com or by postal mail at:

CARGOLUX Airlines International S.A.
Data Protection Unit
Compliance Department
Luxembourg Airport
Luxembourg

The requests may only be made personally by you and you must identify yourself. We must answer your requests within one month, but if your request is too complex or we receive many other requests, we will inform you that this period may be extended by a further period of two months.